Re: allow_url_include is deprecated but no reason or consequences are given
| From: | William Edwards | Date: | Sun, 19 Feb 2023 20:56:45 +0000 |
| Subject: | Re: allow_url_include is deprecated but no reason or consequences are given | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-328162@lists.php.net to get a copy of this message | ||
> Op 19 feb. 2023 om 14:42 heeft Felix Mues <felix.mues@tu-dortmund.de> het volgende
> geschreven:
>
> Hi all,
>
> The "Migrating from PHP 7.3.x to 7.4.x"
> (https://www.php.net/manual/en/migration74.deprecated.php) mentions the deprecation of the php.ini
> entry 'allow_url_include*'*, but does not give any explanation on the consequences.
> Google only pointed me to several Stackoverflow links that stated to simply remove it or to
> sett it to 'off', but nobody explained if this has any side effects/consequences.
>
> So I come here to ask if you can help me:
>
> Is it now on/off by default?
> Did PHP remove the functionality completely?
> Is there an alternative configuration flag?
> I am aware that there are security issues with allow_url_include as mentioned in RFC
> https://wiki.php.net/rfc/allow_url_include, but this RFC was closed
> without removing it.
>
> Is there anything that developers need to do/know when simply removing the flag from PHP.ini?
>
> Why do I ask here and not simply try?
> The reason why I am asking is because will get an issue in one module of the DVWA project
> (https://github.com/digininja/DVWA/pulse) and I am not familiar enough with this part to distinguish
> an hidden error from the intended way this module should work. On the first blink it seems to be
> okay, but I would like to be sure.
>
> And also this is a documentation issue. A deprecation announcement should have at least two
> sentences about the consequences and on what to do if you are affected.
>
> Kind regards
>
> Felix Mues
>
> P.S.: This is my First try posting to a developer mailing list. I hope this will not end up in
> several duplicated mails.
It did ;)
>